
ATIQE ALBERTINI 



31C3 









everyone understan 



static nflCHINE_CONFIG_STflRT( toklo, bubl bobl_state ) 
/* basic machine hardware */ 

nCFG_CPU_flDD( 'maincpu", 2QQ, nflIN_XTflL/-) // 6 flHz 

ncFG_cpu_PROGRfln_nflP(toki o_iiap) 

MCFG_CPU_VBLflNK_INT_DRIVER("screen" , bubl bobl_5tate, i rqe_l i ne_hol d) 

nCFG_CPU_flDD( slave", 288, MflIN_XTflL/0 // 6 HHZ 
nCFG_CPU_PR0GRfln_nflP(tok1 o_sl ave_map) 

nCFG_CPU_VBLflNK_INT_DRIVER( '5creen ■ , bubl bobl_state, i rqe_l i ne_hol d) 

nCFG_CPU_flDD('aud1ocpu", ZSe, nflIN_XTflL/6) // 3 MHz 
nCFG_CPU_PROGRfln_nflP(tokio_sound_Biap) 

nCFG_QUflNTUM_TIME(attOtilie::froiII_hz(6e0e)) 

nCFG_nflCHINE_STflRT_OVERRIDE(bublbobl_state,tokio) 
riCFG_nflCHINE_RESET_0VERRIDE(bublbObl_State,tOkio) 

/* video hardware */ 
nCFG_SCREEN_flDD( screen", RASTER) 

riCFG_SCREEN_RflU_PflRflnS(nflIN_XTflL/4, 384, 8, 256, 264, 16, 248) 
nCFG_SCREEN_UPDflTE_DRIVER(bubl bobl_state, screen_update_bubl bobl ) 

nCFG_GFXDEC0DE(bUblbObl) 
nCFG_PflLETTE_LENGTH( ; : - ) 

/* sound hardware "/ 
HCFG_5PEflKER_STflNDflRD_n0N0("mono") 

nCFG_50UND_flDD("yillsnd", Yn2283, nflIN_XTflL/:) 
nCFG_S0UND_C0NFIG(yill2283_COnf ig) 
HCFG_SOUND_ROUTE(0, "liono", 8.88) 
nCFG_SOUND_ROUTE(l, "mono", 8.88) 
nCFG_S0UND_R0UTE(2, "mono", 8.88) 
nCFG_S0UND_R0UTE(3, "mono", 1.8) 
HflCHINE_CONFIG_END 

not everyone understands software 




This talk is about arcade games, 

tine games wliere you put money to play. 

That money would go in the operator's pocket, 

no share to the arcade manufacturer. 

To be successfull, they had to be awesome. 

"Dedicated" (hardware, controls...) is the key tc 



m success. 
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It's based on the first racing §ame 
Nurburgring (1975) made of 28 PCBs. 






Berzerk was one of the first game with digitized speech. 
It cost 1000 USD / word to be digitized 
(it contained 16 words!)... 
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Battlezone, the first FPS, in 1980... 
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1 ...was turned into a military traine 
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Outrun (Sega 1986), awesome racing game! 





SCORE 
7694 

LAP TIME 
0!54;08 

BEAT 1:38:00 
TO CHALLENGE 



Hard Drivin (1989), a 3d simulation way before modern CPUs existe 
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©KANEKO 1988 
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With awesome piracy came awesome protections, 
once again, dedicated stuff, sometimes 
tiglitly integrated witli tine game internals 
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to store protected data, they went further: 

store data on battery-powered RAM. 

the battery dies, the game dies. 

the manual doesn't even mention it! 

the warranty is void if you open the game's cas 




SONY 



GAMES & 
SYSTEMS 



SIGN IN & 
CONNECT 



INSIDE 
PLAYSTATION*' 



GET 
HELP 



Super Street Fighter® II Turbo HD Remix 



Buy Download 



Download Price: $9.99 



Platform: PS3™ 



Genre: Fighting. Head-to-Head 
Fiahtina , 



Out Now 



(NinTend^ WiiU 



Wii mini 



Nimendo 3DS 



Support 



Search 



NINJA MASTER'S 





Virtual Console 



System Wii 

Release Date 1996 

No_ of Players 2 players 

simultaneous 

Category Action 

Publisher D4 Enterprise 

Wii Points; 900 



CRKHnS (I Xbox One Xbox 360 Xbox live 



Origins 
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Sony 

Entertainment 
Network 



^ Darkstalkers® Resurrection 

p( Capcom U.S.A., Inc. 
V'> ad -r^N P5N Game I Released Mar 12, 2013 | ★**★★ 636 Ratings 




$14.99 
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Arcade games had to be awesome. They were often using dedicated parts, 
they were heavily pirated, they were heavily protected. 
So protected that it makes them vulnerable (to time)! 
Hacking is the only way to preserve them. 
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a final fight bootleg, adding extra characters to control. 
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...but it was defeated nonetheless: 
weak encryption+encrypted data made plaintext attack easy. 
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from Super SF2 (1993) 
to Hyper SF2 (2003) 
(how original !) 



"iim Anniversary Bilition 



here is the complete list of bootlegs, hacks, swaps... 
(absolutely NOTHING) 
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A CPS2 is a sandwich of 2 PCBs 
(sometimes only 1 , sometimes 3) 
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the game PCB contains code+data+protection 
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what's in green is in clear, 
in red is encrypted. 
Code and Data are togetlier 
Code is crypted, data isn't. 
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PROCESSOR 
STATUS 



MC6800 
PERIPHERAL 
CONTROL 



SYSTEM 
CONTROL 




ASYNCHRONOUS 
BUS 

CONTROL 



BUS 
ARBITRATION 
CONTROL 



INTERRUPT 
CONTROL 



Table 3-3. Function Code Outputs 



Function Code Output 


Address Space Type 


FC2 


FC1 


FCO 


Low 


Low 


LOA 


[Undefined, Reserved) 


Low 


Low 


High 


User Data 


Low 


High 


Low 


User Program 


Low 


High 


High 


(Undelir»ed, Reserved) 


High 


Low 


Low 


(Undefiried, Reserved) 


High 


Low 


High 


Supervisor Dal.~ 


High 


High 


Low 


Supervisor Program 


High 


High 


High 


CPU Space 



Table 6-2. Exception Vector Assignment 



Vectors Numbers 


Address 






Hex 


Decimal 


Dec 


hHex 


Spaced 


Assignment 


0 


0 


0 


000 


SP 


Reset: Initial SSp2 


1 


1 


4 


004 


SP 


Reset: Initial PC^ 


2 


2 


8 


008 


SD 


Bus Error 


3 


3 

11 ic;do 1 lu 


12 

II lUCI o. 


OOC 


SD 


Address Error 



decryption is made on tine fly, vector (0) requir es four words, unlike the other vectors which only 



during memory fetch 
read standard memory? as is 
read for execution? decrypt 



r°auire two words, and is located in the supervisor program space. 



patch an opcode (unknown encryption) 
black screen, game over, retry ? 



AY?ESOME 




NEO-GEO 



AAAX 330 MEGA 
PRO-GEAR SPEC 




Capcom had a major competitor. 
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as a last effort, they backported a recent CPS2 game 
the first decrypted CPS2 port !!! 






to defeat a dragon, you need adventurers: 

Razoola, Charles MacDonald, Andreas Naive, Nicola Salmoria, David Haywood, and many others. 
(I worked with Razoola, and helped him on the PC side) 



ILLEGAL INSTRUCTION 

ADDRESS : 7A0A0000 
AC ADRS: 
R W : 
MODE : 
FC : 



D0:FFFF4A44 D4:00A80158 A0:6FC42E65 A4:00FFB380 
D 1 : □□□□□□□4 D5 : OOOOFFFF A 1 : OOFFOS 1 C A5 : □□□□□□□□ 
D2:00080000 D6 A2:007082F0 A6:FFFFAD80 
D3:00000008 D7 A3:00FFB19A A7:0000000A 

SSP : □□FF08 1 C 
SR : 4A44 

+□ +2 +4 +6 +8 +A +C +E 
□□FF8000 OOIO □□□□ □□□2 □□□□ □□□2 0071 □□□□ □□□□ 
□□FF8010 □□□□ □□□□ □□□□ □□□□ 5680 □□□□ □□□□ 9000 
□0FF8020 92C0 90C0 9100 9160 9140 □□□□ □□□□ 01 DA 
□□FF8030 OOOC 0165 0006 OOOC OOOF 12C2 □□□□ □□□□ 
□□FF8040 □□□□ OOQO □□3F 7000 807D 1234 □□40 OOIO 
□□FF8050 □□□□ □□□□ □□□□ □□□□ 0000 □□□□ □□□□ □□□□ 
□□FF8060 E021 OFOC □□□□ □□□□ OIOO FFFF FFFF FFFF 
□□FF8070 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 



In November 1999, Razoola re-enabled SFZ's internal debugger (first working CPS2 patch I) 
not blind anymore ! 



in spring 2000, lie found tliat some specific memory ranges were not using encryption! 
winy ? no reason - just a big facepalm ! ^pi f^f^J^i 

sliellcode execution for a split second. 




Mode 



Register Direct Addressing 

Data Register Direct 
Address Register Direct 



Absolute Data 

Absolute Short 
Absolute Long 



Addressing 



Program Counter Relative 

AddressingI 
Relative with Offset 
Relative with Index and Offset 



Register Indirect Addressing 

Register Indirect 
Postincrement Register Indirect 
Predecrement Register Indirect 
Register Indirect with Offset 
Indexed Register Indirect with Offset 



Immediate Data Addressing 

Immediate 

Quirk ImmpdiatP 



when reading relatively to code (PC), 
memory fetches are actually decrypted ! 
Sega prevented that, but Capcom failed, 
first CPS2 decryption, word by word 



Generation 



EA=Dn 
EA=An 



EA = (Next Word) 

EA = ^Next Two Words) 



EA = (PC)+di6 
EA = (PC)+d3 



EA = (An) 

EA = (An). An <- An+N 
An*An-N, EA=(An) 
EA = (An)+di6 
EA - (An)+(Xn)+d8 



DATA = Next Word(s) 
Inherent Data 



EA = SR, USP. SSP. PC. 
VBR. SFC, DFC 



Syntax 



Dn 
An 



(XXX). W 

fxxxVL 



(di6PC) 
(d8,PC,Xn) 



(An) 

(An)^ 

-(An) 

(dl6An) 

(dg.An.Xn) 



#<data> 



SR,USP,SSP,PC, 
VBR SFC.DFC 



I iii b iii uuu l b b iii n i d i lu l il t; ii nJ de described in 2.2.7 Address Register Indirect with Index 
(8-Bit Displacement) Mode, except the PC is the base register. The operand is in memory. 
The operand's address is the sum of the address in the PC, the sign-extended displacement 
integer in the extension word's lower eight bits, and the sized, scaled, a nd sign-e xtended 
index operand. The value in the PC is the address of the extension word. [This is a program 
reference allowed only for reads. The user must include the displacement, the PC, and the 
index register when specifying this addressing mode. 
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so, in Summer 2000, I visited Raz, lioping we'd break tine algo. 
but no success... 
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reset 



nop 
nop 
nop 

move . b 

nop 

nop 

nop 

nop 

nop 

nop 

nop 

rnove.b 
cmpi . 1 
lea 
bra 



»$88, $866836.1 



»$e, $888638.1 
»$5642194, D8 
($6, PC), fl4 
$d82 



1 la;* 
1 CO 


/ «x PC \ ao 


1 

1 cd 




DlO 


*er o 


Dro 




jmp 




jmp 




movcLi 


111 LI / 


movccj 


"■Hi I U/ 


niovc. 1 




move. 1 




ump 1 ■ 1 




IIIUVC. 1 


\ no y ^ , V n 1 y 


lllUVC* 1 




Ur . 1 




Ql • 1 




iTIIJVCa 1 


^ no ^ ^ , \ n 1 y 


Mrk\/A 1 




1 

Ui • 1 




f\t^ 1 

Ol • 1 




niovc. I 


^ no )^ f \r\L ) 


move. 1 




or. 1 


D0, (fll)+ 


or. 1 


D0, (Rl)+ 


move. 1 


(fi0)+, (RI) 


move. 1 


(fie)+, (Ri) 


or. 1 


00, (fll)+ 


or. 1 


D0, (fll)+ 


move. 1 


(R0)+, (RI) 


move. 1 


(ft8)+, (RI) , 


or. 1 


00, (fll)+ 


or. 1 


□8, (fll)+ ' 


move. 1 


(R0)+, (RI) 1 



in December 2000, Raz noticed tliat Capcom 
leaked tine l<ey to l<eep decryption alive, 
automated dump is now possible ! 



NOW PB1 TFFf.RriWf; 

Cf>rr>|pt»il 3 363A Crcrupt#(i ; 
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we dumped by connecting the CPS2 to the joystick port of the PC. 
ugly, clumsy, slow, but worked ! 
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(NOT USED) 



REGISTER! 

[{NOT USED/ 



communication! 
ports (not used)] 
outITnI 




^JAMMA"^^^AUXILIARY CABLE ^^AUDIO OUT (FOR Q SOUND)] 
[C0NNECT0R™M CONNECTOR ] 
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STREET FIGHTER ZERO 
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5 ,i::fen reset 
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Gorre CPU 


^elbng? Video Sfiund Help 


















INSERT P COINS 
CONTINLC RECLHRES ONLY 1 COIN 
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System leset 
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Game CPU Settings Video Sound Nel Hdp 




OScMnd Chips ha^^e been 4e«>e1cpe<l bm OScund 
and i nco rporaire OSrund's p rrpr i etrary ©©curd 
sound f»nb^nr«afi»ent technclc^U, 



CAPCOM 



System reset 





storiRS 
submissions 
popular 
blog 

ask slashdot 

book reviews 

games 

idle 

yro 
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CPS-2 Encrvption Scheme Broken 



Posted bty Hemos on Sunday January 07. 2001 @10:44AM 
from the more-roms-for-al depi 



Acheon writes: 



The CPS-2 arcade board from Capcom uses some hard encryption 
scheme that has been a very hot issue in emulation for years Yet 
finally the code was brol<en Final Burn , a quite recent arcade emulator i 
showed concrete results by running previously unsupported games 
such as Street Fighter Zero using decrypted ROM images. The CPS-2 
Shock Team, who managed to reverse engineer the process for 
scratch, really outdone themselves and it is a very uncommon 
achievement.' 



TheJ^Register' 




the news didn't get it right, as usual. 



CPS2 arcade encryption smashed 

Morality debate ensues 

By Lucy SherrifY • Get mor* from this author 

Posted in Business. 8th January 2001 19.44 GMT 

A group Of gaming enthusiasts called the CPS-2 Shock Team claims to have broken the encryption on 

the CPS-2 arcade board from Capcom. 

While the algorithm Itself has not been compromised, the gnDup has managed to extract unencrypted 
data from the board using the 68k code on the hardware itself, according to a poster on SlashDot. 
Whether this actually constitutes a break of encryption is a subject under discussion at the 
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Joystick &n«i button 1 



[►3 rtemorv VleNer- 

[ 1 DUwio data. 

[ 3 MUEio »l«V*r> 

[ 3 Run Lo«<Je<i Ga«»c. 



OO MOT aiSTRI THIS SQF TUAHE. 



8t«rt PO so<ft»i«re > ff««ke sUre lead 

COnnc»c t »d« C button | tO conti nu»] 



Ue« joVEt iok to okoos* ^ roSion to 
du*p- CbilttOA 1 to continue) 



> ROH DAMK 1 < 



NOW nunPING PI FASE MA IT. 



CXXXX-h J 



but with 'joystick dumping', tliat was defeated quicl<ly :p 
(decryption done by Nicola Salmoria) 



Uae- the JoV9 1 t cH to acroll «nd thi 
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Button 1 

Button a 

Dutton 3 • 

Button 4 : 

OFFSET +0_ 

OOOOOOOO OOlO 

□aoooDos oano 
OOOOOOIO oooo 
□ooooais oaco 

888888^8 8888 
8888883S 88S8 

□ogooa^o oano 
00000048 OOOO 
□ooooa!i.o oora 

888888iS 8888 
88888893 8888 

00000078 oano 



ced sor o I I • 
.:;no to bank. reBlon. 
fo99le selected b«nk' 
UU I t. 



42 ^-4 4. 



F3O0 OOOO 0402 

§40a DOCO G^OF 
414 OOOO 04 2G 

m% 8888 im 

im 88S8 sais 
im 88S8 %m 

oa'jG ooca o436 

mt 8888 

im 8888 im 

D4 76 OOnO 0 4 76 
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Use PO tool to create needed files 
■for V9r I C button 1 to contlnUfi»3 



Ue* JoVE-tiok to okooEO A roSion t o 
verlfV' (button 1 to continue} 
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VERiryiPtG AOORCGG ♦«s000032r2 



no MOT OISTRIBUTF THIS BOF TMAR: 



move >_ 
move . w 
move . w 
move . w 
move. w 
move. w 
move. w 
move. w 
cmpi . 1 
lea 
bra 

move. w 
move. w 
move. w 
move. w 
move. w 



#S7QQQ, $400000,1. 
#$0, $8040a0.1 
#$807d, $400002.1 
#$1234, $400004.1 
#$0, $400006.1 
#$40, $400008.1 
#$10, $40000a.l 



#$fO0, $804040.1 

#$5642194, DO 

($6, PC) , A4; ($9d6) 

$e82 

#$ffcO, $80010c.l 
#$0, $80010e.l 
#$9000, $800100.1 
#$9080, $800102.1 
#$90c0, $800104.1 



video and sound registers liad a different address on dead 
patching these addresses maizes them work again ! 



move 
move . w 
move . w 
move . w 
move. w 
move.w 
move. w 
move.w 
cmpi . 1 
lea 
bra 

move . w 
move . w 
move.w 
move . w 
move.w 



#$7000, $fffff0.1. 
#$0, $8040a0.1 
#$807d, $fffff2 
#$1234, $fffff4 
#$0, $fffff6.1 
#$40, $fffff8.1 

#$10, $fffffa.l 

#$fOO, $804040.1 

#$5642194, DO 

($6, PC) , A4; ($9d6) 

$e82 

#$ffcO, $80010c.l 
#$0, $80010e.l 
#$9000, $800100.1 
#$9080, $800102.1 
#$90c0, $800104.1 



workflow: decrypt code, merge with data, patch addresses... 




SUICIDE CPS2 GAME 


BOARD 1 LS 1 LH 


ON BOARD RAM TE 


:sT 


WORK RAM 
GFX RAM 
OBJECT RAM 


= GOOD 
= GOOD 
= BAD 


SOUND 1 N 1 T 
O SOUND RAM 


= GOOD 
= GOOD 


ERRORS FOUND ON 


GAME BOARD 




( C ) RAZOOL A J HWW ■ CPS2SH0CK , COM 




Razoola made a universal test ROM, 
and 'no more battery' Phoenix versions. 




> REGION SETUP < 
JUKEBOK PLAYER 
START GAME 




this also made bootlegs possible. 

no more battery... 

from MegaMan to Gigaman :( 




CAPCOi GPSM 18 miZ 

1 / 2Pas4^ 



r1 . Gifl^ Wins 
2. RooKman 2 
3. Marvel VS 
4-- R i oT 
1 ^. Super ou 






CPS2, 1994 





so now even the most obscure CPS2 games were preserved, 
but the encryption was still unknown. 

and it would take us 200 years to dump all possible values for one game 







CONT INGE 9 




so we needed someone else to continue... 



ilii 



-ChSo c >^ 



)3 



■ 1 1 ■ 



fil, 



0 

IZZI 

HI 



01=1 



T. 



J3-^ 9—0 



Charles MacDonald is an awesome hacker, with special weapons. 
Here, his PAL blackboxer. 

So, he took the CPS2 PAL, determine their internal configuration 
by blackboxing them, replace them with GALs. 
He now had controls over memory mapping ! j -A 



r 



0 



H 




/fi 



T 

USB!!! 



to dump CPS2 directly via its expansion port, to USB !!! ^ 
He could dump the 8 Gb set in 1 7h. < ^ 

He did that for several games, but that wasn't enough to understand the algorithm. 



to understand 




TINUE? 
04 



CONTINUE? 
04 




so someone else needed to continue to break the algo. 



that's where Nicola Salmoria and Andreas Naive helped, 
they're awesome to determine encryption algorithm, 
the algo was feistel based, and the key was 64 bits. 




so, from one european decrypted dump of a game, 
the key could be determined, 

which could then decrypt the rare Japanese version of the game. 



ROCKMAN THE POWER BATTLE 
9 5 □ 9 2 2 
J A P A t4 



WORK 
CPSO 
CPSl 

CPS2 



RAM OK 

RAM OK 

RAM OK 

RAM OK 



WORK 

CPSO 

CPSl 

CPS2 

OBJECT 

O SOUND 



RAM OK 

RAM OK 

RAM OK 

RAM OK 

RAM OK 

RAM OK 



O LI N O 



VOICE 



c;oiiNr' roTF No. 



TEST 



OOon 



3 • S O U N D 



VOICE 



TEST 



SOUND CODE No. QCKIO 



CODE +OI 

CODE -lO 

REOLCST 

STOP 



IP Lip 

IP DONN 

IP RIGHT 

IP LEFT 

IP BHOT1 

IP SHOT2 



CODE +OI 
CODE -r»i 
CODE +IO 
CODE -lO 
REOLiEST 
STOP 



I r I r~ 

IP ' '-•-■^ 

IP tt-t ! I 

IP SHOTa 



VOLUME 



MIN 



1 1 



+++++++++++++++++^^ 



EXIT = IP 6< 2P START 



Last, Dave Haywood designed an attack to determine 
tine l<ey just from tine ENCRYPTED dump of tine game. 
So even tine rarest CPS2 game was preserved ! 



CLunsy HACKS 




SUCCESS 



many people contributed, in various ways 




this is tlie Bubble Memory system 
it's very fragile. 



W>^nHINB UP NObV 



to work, it needs to warm up to a certain temperature, 
to me, tinis big countdown says: 

'all these games are going to disappear if no one hacks or contribute for them' 



PHESENTED BY l<ah^4M I 



Last Survivor, a System X game from 1989, 
was thought to be lost forever. 
Someone still had one in working conditions: 
it was preserved, 20 years later ! 




CPS2Shock 

http://www.cps2shock.com 

http://web.archive.org/web/*/http://cps2shock.retrogames.com 
Charles MacDonald 

http://cgfm2.emuviews.com/old2005.php 



Nicola Salmorla 

http://mamelife.blogspot.com/2006/01/8gb-2-is-still-4gb.html 
Andreas Naive 

http://andreasnaive.blogspot.com/2006_12_01_archive.html 
lilame (CPS2 encryption source) 

https://github.eom/mamedev/mame/blob/master/src/rnarne/machirie/cps2crpt.c 



DarkSoft 

http://64darksoft.blogspot.com 




SFA3 has a time lock: if you let it run long enough, 
some special modes are unlocked, 
the title background tells how many modes are unlocked 





pj;i£sbi$ 'IP mi jip ^rsiftt 




y2 




Ps^S^ 4ti Oti nisi ^fhttt 



iTiiif 



Hidden in tine operator menu, 
Razoola found tine crazy clieat codes 
in tine disassembly to turn on tiiis 
extras witliout waiting weeks. 



G ^ M E 



DATA 



CO IN 



COUNTER 00n03B 



SERVICE COUNTER UOUOOO 
FHEEPLOY COUNTER OOOOOO 



■ 



PI : 

P2: R D 



R D 



4 



LP 

IT I 





;e for it... 




o 



USB-B 



Sega-USB Link I 

<C) 2004-2011 Charles flacDonald 

http: //cgfni2< emuv^ieus. com 



O 



Charles MacDonald also worked on Sega hardware and created his own devic 




modern tools show how fighting games engine actually work 
damage areas change from one version to the other. 








attack behind you, or be hit for no reason... 






